From threat signal to prioritised action.
Follow one real vulnerability — CVE-2021-44228, Log4Shell — as it moves through Seraph CTI's intelligence engine: collected from external feeds, analysed and connected to real-world exploitation, matched against your environment, and turned into a prioritised action.
What actually feeds this.
The Log4Shell walkthrough below follows one vulnerability — but the same engine runs continuously across every source, all the time.
Collect
A new vulnerability is disclosed. Seraph has it within hours.
Seraph continuously ingests vulnerability disclosures, CISA KEV updates, breach and leak sources, and threat actor reporting from external intelligence feeds — not a nightly batch job.
- SourceNVD / CISA KEV
- Affected SoftwareApache Log4j 2.x
- DisclosedPublicly disclosed
- StatusEntering Seraph CTI catalogue
Analyse & Connect
The vulnerability is scored, flagged and linked to real-world exploitation.
Seraph cross-references CVSS and EPSS scoring, confirms CISA Known Exploited Vulnerabilities status, and connects the CVE to threat actor groups observed exploiting it — turning a bare CVE number into context.
- CVSS10.0 (Critical)
- CISA KEVYes
- Known ExploitationObserved, multiple threat actors
- MITRE ATT&CKT1190 — Exploit Public-Facing Application
Match to Your Environment
Seraph checks whether this actually affects you.
The vulnerability is compared against your organisation's technology watches — the specific software and platforms you've told Seraph you run — not the entire internet's exposure.
- Technology WatchApache Log4j
- Match StatusAffected assets found
- Assets Identified3 internet-facing services
- Exposure LevelHigh — public-facing
Prioritise & Act
A prioritised alert reaches your team, not a buried CVE number.
Seraph surfaces the alert with a priority tier and recommended action, so your team can patch, investigate or escalate — instead of triaging a raw feed of thousands of CVEs.
- PriorityCritical — act within 24 hours
- Recommended ActionPatch / apply mitigation
- Routed ToSOC investigation queue
- StatusAwaiting remediation confirmation
- Patch
- Investigate
- Escalate
Intelligence, then whoever's best placed to act on it.
Not every finding is handled the same way. Seraph CTI routes each one to the right place — your own team, or a Seraph Cyber service when specialist work is needed.
Patch & Remediate
Handled directly by your team once a fix or mitigation is available.
Ready to see this engine running in your organisation?
Book a demo for a guided walkthrough of Seraph CTI, or talk to our team about your requirements.